CMMC-CCA Exam Question 81
To verify the scope accuracy and integrity, a Lead Assessor asks for documents supporting some elements of the scope. However, the OSC states that the information is proprietary and requires that the Lead Assessor sign a Non-Disclosure Agreement (NDA) before granting access. What should the Lead Assessor do?
CMMC-CCA Exam Question 82
You are part of the Assessment Team evaluating an OSC's implementation of AC.L2-3.1.13 - Remote Access Confidentiality. This requirement mandates the organization to employ cryptographic mechanisms to protect the confidentiality of remote access sessions. During your assessment, you want to determine whether these cryptographic mechanisms have been properly identified as required by assessment objective [a]. What specification can you use to make this determination?
CMMC-CCA Exam Question 83
Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings.
Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment. Which document/template includes the OSC's evidence, assets, and CMMC assessment scope, among other data?
Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment. Which document/template includes the OSC's evidence, assets, and CMMC assessment scope, among other data?
CMMC-CCA Exam Question 84
When discussing the OSC's proposed assessment scope, the Lead Assessor learned that some laptops and workstations share a network with CUI assets, but their users do not work with CUI. These assets do not store CUI or run applications that process CUI. Reviewing the OSC's SSP, the implemented risk-based security policies, procedures, and practices raised questions and were found to be deficient. What can the Lead Assessor do in this scenario?
CMMC-CCA Exam Question 85
You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What does the criterion of 'Adequacy' primarily assess in the context of evidence collection for a CMMC assessment?